240 matches found
CVE-2023-42431 Potential XSS on user preferences page
Cross-site Scripting XSS vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context...
CVE-2023-42431 Potential XSS on user preferences page
Cross-site Scripting XSS vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context...
wger Workout Manager Cross-Site Request Forgery vulnerability
Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...
CVE-2023-38759
Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...
CVE-2023-29724
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with...
CVE-2023-29724
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with...
CVE-2023-29725
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting...
CVE-2023-29725
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting...
PT-2023-22376 · Unknown · Bt21 X Bts Wallpaper
Name of the Vulnerable Software and Affected Versions: BT21 x BTS Wallpaper app version 12 Description: The issue allows unauthorized apps to request permission to modify data in the database that records user personal preferences. This data is loaded into memory when the app is opened, and an...
PT-2023-22377 · Unknown · Bt21 X Bts Wallpaper
Name of the Vulnerable Software and Affected Versions: BT21 x BTS Wallpaper app version 12 for Android Description: The issue allows unauthorized applications to request permission to insert data into the database that records user personal preferences. This data is loaded into memory when the...
CVE-2023-29722
The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker cou...
PT-2023-22375 · Google · Android
Name of the Vulnerable Software and Affected Versions: Glitter Unicorn Wallpaper app for Android versions 7.0 through 8.0 Description: The issue allows unauthorized applications to inject data into the database that stores user personal preferences, which can be loaded into memory and used when t...
Sql injection
Gentoo soko is the code that powers packages.gentoo.org. Versions prior to 1.0.1 are vulnerable to SQL Injection, leading to a Denial of Service. If the user selects in user preferences the "Recently Visited Packages" view for the index page, the value of the searchhistory cookie is used as a...
SUSE CVE-2017-2642
Moodle 3.x has user fullname disclosure on the user preferences page...
SUSE CVE-2017-2641
In Moodle 2.x and 3.x, SQL injection can occur via user preferences...
GHSA-9X9J-VRHJ-V364 Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page...
CVE-2022-28731
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page...
MAL-2022-7177 Malicious code in wix-user-preferences-webapp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29e4630a25b98ef601b67373c19a7e895e64e5c6ce1ae6cb9fdbafa41d101036 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in wix-user-preferences-webapp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29e4630a25b98ef601b67373c19a7e895e64e5c6ce1ae6cb9fdbafa41d101036 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...